Moving personal data out of Europe,
on terms that hold up.

The GDPR restricts transfers of personal data to countries outside the EEA (Article 44). A transfer is allowed if the destination has an adequacy decision (Article 45), if appropriate safeguards are in place (Article 46), or, for occasional transfers, under a narrow derogation such as explicit consent (Article 49). Standard contractual clauses are the most used safeguard: Article 46(2)(c) lets parties rely on clauses adopted by the Commission without asking a supervisory authority for approval.

The current EU SCCs were adopted on 4 June 2021 in Commission Implementing Decision (EU) 2021/914. The two older sets were repealed from 27 September 2021, and contracts signed on them stopped providing safeguards after 27 December 2022. If a vendor still sends you 2010 clauses, they are out of date. A separate Decision, (EU) 2021/915, provides optional clauses for controller-processor contracts inside the EEA; those are not transfer tools.

A transfer impact assessment (TIA) is the analysis Clause 14 requires before you transfer. Both parties warrant that they have no reason to believe the destination's laws and practices, including rules on government access to data, prevent the importer from meeting the clauses. To give that warranty, Clause 14(b) requires you to take account of:

• the specific circumstances of the transfer: the processing chain, the parties, the purpose, the categories and format of the data, the sector and where the data is stored;
• the laws and practices of the destination relevant to those circumstances, and their limits and safeguards;
• any contractual, technical or organisational safeguards you add, such as encryption where the importer does not hold the keys.

Clause 14(d) requires the assessment to be documented and made available to the supervisory authority on request. The EDPB's Recommendations 01/2020 (final version adopted 18 June 2021) set out the method in six steps: know your transfers; identify the transfer tool; assess whether it is effective given the destination's law and practice; adopt supplementary measures where it is not; take any procedural steps; and re-evaluate at appropriate intervals. If the assessment shows the data cannot be adequately protected, Clause 14(f) requires you to suspend the transfer.

In practice a TIA is a short structured document per vendor or per transfer type. The vendors that matter most are your critical tier: the ones that hold production data. See our vendor risk management guide for how to tier them.

The Commission adopted its adequacy decision for the EU-US Data Privacy Framework (DPF) on 10 July 2023. A transfer to a US company that has self-certified to the DPF and covers the data you send needs no SCCs or TIA. Transfers to US companies outside the DPF still need SCCs and a TIA. You can check a company's status on the public DPF list, and certifications must be renewed every year.

The framework is in force but contested. On 3 September 2025 the EU General Court dismissed the first challenge to it (Latombe v Commission, T-553/23). In June 2026 the US Supreme Court, in Trump v. Slaughter, held that statutory protections against the President removing Federal Trade Commission members were unconstitutional; the FTC is one of the DPF's enforcement bodies. The privacy group noyb then asked the Commission to repeal the decision and said it would bring an annulment action. Until a court annuls it or the Commission withdraws it, the adequacy decision stands. The two previous EU-US arrangements were both struck down by the Court of Justice, so many companies keep SCCs in their US contracts as a fallback that takes effect if the DPF falls.